@bongos/core 1.19.137 → 1.19.138

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.137",
-  "core_contract": "1.19.137",
-  "source_commit": "9fa1fb193ed67e42c77580783b8d46b43dfc04cd",
+  "core_version": "1.19.138",
+  "core_contract": "1.19.138",
+  "source_commit": "c881ff7b166e960c529748049090f53ad17276c8",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:29:50.076Z",
+  "built_at": "2026-08-15T14:53:14.334Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "106a541f9d1c75255cd4bf29b2cb87f60cb07a6f413f81d3a27f0b7887eaa200",
+  "tree_sha256": "09b573285811157440bc46ef823f8ae2adf4735d9a0d559e656a7a68793a0bdf",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "82ff1180ef9d22a39f2ea3af15eecd26e9598c7c98d85b501030ab8c67566e7e"
+      "sha256": "b3bd34c7f961631c76f810499e202ecf7ff7b28beb3933da63fd89be5b684e6b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a60b9403891192d3338e76f313135db3bec75a8205920c839b6bdb5a95b40661"
+      "sha256": "470274822238a12b1ad33021c5c9fc233f69beefdb30730fc7208257e01a11ef"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "ac866c928701c41ac7f055f8807590a3db71eb2538502a54a6fca9ac1d79868d"
+      "sha256": "060cfd1249c09576e634c7c84c8470207cf55b93cb0719cc89821c8c59aa2a17"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d4b3ac997a8dbf4acfdda32a4b62622908fdc87fcef6dbbfa563d49b76be34ce"
+      "sha256": "b5bbd063bab04b41b5fa8769f2c8de1e0919c28be09bcdf45345ff9440558205"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "7f2fe0290fc0a429b54ca53d449453e9009a57e40bb8003b2718beef33be2309"
+      "sha256": "d0907a08d6b932d25df7b143e82c94d64a15eab66a7bd1df86ba85b1729661b7"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.137",
+  "version": "1.19.138",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.137",
+      "version": "1.19.138",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.137",
+  "version": "1.19.138",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -2668,7 +2668,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
     }
 

package/src/module-api.js

@@ -701,8 +701,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.135 with no explicit bump. run 31889474899. (task 1002620)
 //   1.19.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
+//   1.19.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.137'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.138'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/public_landing_projects.mjs

@@ -117,6 +117,21 @@ test('the empty state points a new owner at the wizard view — never at a hall'
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
+test('the manual-repo step states placement and visibility — the owner never has to ask', async () => {
+  // QA walk F7 (task 1002702 → 1002721, owner firsthand): the "Create the empty
+  // GitHub repo" step never said WHERE the repo lands, and the owner had to ask
+  // "is there somewhere specific I should set it up?" mid-walk. The step must
+  // say the repo belongs at the exact prefilled owner/name (changing GitHub's
+  // Owner dropdown strands the build watching the wrong address) and must state
+  // the visibility choice up front, before GitHub's own radio is the first
+  // mention.
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /Owner box/, 'the step must name GitHub’s Owner box and say to leave it as prefilled');
+  assert.match(body, /exact address|exactly[^<]*repoLabel|land at exactly/,
+    'the step must say the build watches the exact owner/name');
+  assert.match(body, /public or private/i, 'visibility must be stated in our copy, not first seen on GitHub');
+});
+
 test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // the DECIDED policy: shared shapes keep the database; a dedicated machine